Re: allowing local accounts when LDAP is unavailable?

host ldaplb1 ldaplb2 ldaplb3

base ou=Users,ou=Employees,dc=example,dc=com
binddn cn=dcAuth,ou=Applications,dc=example,dc=com
bindpw example
scope sub

# Search timelimit
timelimit 5

# Bind/connect timelimit
bind_timelimit 2

# Reconnect policy: hard (default) will retry connecting to
# the software with exponential backoff, soft will fail
# immediately.
bind_policy soft

# Idle timelimit; client will close connections
# (nss_ldap only) if the server has not been contacted
# for the number of seconds specified below.
idle_timelimit 3600

# must be set or sudo will ignore LDAP
sudoers_base   ou=sudo,ou=Applications,dc=example,dc=com

# verbose sudoers matching from ldap
#sudoers_debug 2

nss_base_passwd         ou=Users,ou=Employees,dc=example,dc=com?sub
nss_base_shadow         ou=Users,ou=Employees,dc=example,dc=com?sub
nss_base_group            ou=Group,ou=Employees,dc=example,dc=com?sub
nss_base_netgroup       ou=Netgroups,dc=example,dc=com?sub

# Just assume that there are no supplemental groups for these named users
nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon

ssl no
tls_cacertdir /etc/openldap/cacerts
pam_password md5

On Sun, May 3, 2009 at 12:19, Josh Miller <joshua@...> wrote: